Skip to content

Configure WAF on the Azure Front Door #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IEvangelist merged 2 commits into from
Jan 31, 2026
Merged

Configure WAF on the Azure Front Door #324

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b5cdbf9
Configure WAF on the Azure Front Door
eerhardt Jan 30, 2026
d81b7bb
Fix invalid wafPolicy name
eerhardt Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 81 additions & 0 deletions src/apphost/Aspire.Dev.AppHost/Bicep/front-door-appservice.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ param appServiceHostName string
@description('Location for all resources, needed because Aspire always injects a location parameter')
param location string = resourceGroup().location

@description('Rate limit threshold value for rate limit custom rule (requests per 5 minutes)')
param rateLimitThreshold int = 500

resource frontDoorProfile 'Microsoft.Cdn/profiles@2024-02-01' = {
name: take('${frontDoorName}${uniqueString(resourceGroup().id)}', 50)
location: 'Global'
Expand Down Expand Up @@ -96,3 +99,81 @@ resource route 'Microsoft.Cdn/profiles/afdEndpoints/routes@2025-06-01' = {
}

output endpointUrl string = 'https://${frontDoorEndpoint.properties.hostName}'

// WAF Policy for DDoS compliance
resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2025-03-01' = {
name: take('${frontDoorName}-waf-AppDDoS${uniqueString(resourceGroup().id)}', 128)
Comment thread
eerhardt marked this conversation as resolved.
Outdated
location: 'Global'
sku: {
name: 'Premium_AzureFrontDoor'
}
properties: {
policySettings: {
enabledState: 'Enabled'
mode: 'Detection'
Comment thread
eerhardt marked this conversation as resolved.
customBlockResponseStatusCode: 403
requestBodyCheck: 'Enabled'
javascriptChallengeExpirationInMinutes: 30
}
customRules: {
rules: [
{
name: 'GlobalRateLimitRule'
enabledState: 'Enabled'
priority: 100
ruleType: 'RateLimitRule'
rateLimitDurationInMinutes: 5
rateLimitThreshold: rateLimitThreshold
matchConditions: [
{
matchVariable: 'RequestUri'
operator: 'Contains'
negateCondition: false
matchValue: [
Comment thread
eerhardt marked this conversation as resolved.
'/'
]
transforms: []
}
]
action: 'Block'
}
]
}
managedRules: {
managedRuleSets: [
{
ruleSetType: 'Microsoft_BotManagerRuleSet'
ruleSetVersion: '1.1'
ruleGroupOverrides: []
exclusions: []
}
]
}
}
}

// Security policy to associate WAF with Front Door endpoint
resource securityPolicy 'Microsoft.Cdn/profiles/securityPolicies@2025-06-01' = {
parent: frontDoorProfile
name: take('${frontDoorName}-AppDDoS${uniqueString(resourceGroup().id)}', 260)
properties: {
parameters: {
type: 'WebApplicationFirewall'
wafPolicy: {
id: wafPolicy.id
}
associations: [
{
domains: [
{
id: frontDoorEndpoint.id
}
]
patternsToMatch: [
'/*'
]
}
]
}
}
}
Loading